The call to const signatureLength = data.indexOf('{'); doesn't check that { exists in the string (it's assuming so without checking the return value is not -1) thus:
signature will be all the string without last char
jsonB64 will be last char in string, which will be passed to JSON.parse, number 0-9 is a single valid char for json.
so data like:
[sig]X
where X is number and [sig] is signing of number X, will pass verification.
The call to
const signatureLength = data.indexOf('{');
doesn't check that{
exists in the string (it's assuming so without checking the return value is not -1) thus: signature will be all the string without last char jsonB64 will be last char in string, which will be passed to JSON.parse, number 0-9 is a single valid char for json. so data like: [sig]X where X is number and [sig] is signing of number X, will pass verification.https://github.com/MohGovIL/hamagen-react-native/blob/14dd43b9e0c502497969c836ba591d51989eb446/src/services/SigningService.ts#L13-L28
fix:
data.indexOf
operation, abort if it's -1.